Port 991 sits in the well-known range with an official assignment, a published RFC, and almost no traffic. It's the Internet's equivalent of a perfectly preserved building that nobody visits anymore.
What Runs on Port 991
Port 991 is officially assigned to NAS (Netnews Administration System), a protocol designed to manage Usenet newsgroups. Defined in RFC 4707 in October 2006, NAS was meant to simplify the administration of network news by maintaining newsgroup and hierarchy data in a distributed database accessible through a client-server protocol.1
The protocol handles administrative tasks like managing feed configurations, enforcing moderation controls, and synchronizing policies among distributed news servers. It works alongside NNTP (Network News Transfer Protocol), focusing on the administrative side rather than the content delivery.2
The Reality
NAS is officially assigned but practically abandoned. Usenet—the decentralized discussion system it was built to manage—has been in decline for years. People moved to web-based forums, then social media, then Reddit. The infrastructure that needed NAS doesn't really exist at scale anymore.
RFC 4707 is marked "Experimental" and explicitly states it's "not a candidate for any level of Internet Standard."1 It was published in 2006, after Usenet's peak had already passed. The protocol arrived to manage a system that was already fading.
Why This Port Matters
Port 991 is a reminder that official assignment doesn't guarantee usage. IANA can reserve a port, engineers can write an RFC, developers can implement the protocol—and the world can still move on to something else.
The well-known port range (0-1023) contains ports that seemed essential when they were assigned. Some still carry the Internet's core traffic. Others, like 991, sit empty—monuments to protocols that solved real problems but couldn't compete with what came next.
Security Considerations
Because port 991 sees almost no legitimate traffic, any activity on this port should be investigated. Attackers sometimes use obscure assigned ports for covert channels precisely because they're unlikely to be monitored.
If you see traffic on port 991:
- Check if you're actually running any Usenet news server software
- Verify the source and destination of the traffic
- Consider blocking the port entirely if you're not using it
How to Check What's Using Port 991
On Linux/macOS:
On Windows:
You'll almost certainly find nothing. That's normal.
Related Ports
- Port 119: NNTP (Network News Transfer Protocol) — the protocol that actually carries Usenet articles
- Port 563: NNTPS (NNTP over TLS/SSL) — secure version of NNTP
- Port 433: NNSP (Network News Sync Protocol) — another Usenet-related protocol
All of these carry more traffic than port 991, but none of them are exactly bustling.
Frequently Asked Questions About Port 991
Byla tato stránka užitečná?